Nansen Reviews How Crypto Giants Rescued Themselves: How to Prevent a $10 Billion Domino Collapse

Author: Nansen

Compiled by: Katie, Odaily Planet Daily

With the further development of the stETH depeg incident, many speculations have emerged around this topic. The imbalance in Curve's stETH/ETH pool can clearly be traced back to the depeg of UST.

This report from Nansen starts with the LUNA crash and covers a series of "domino" effects involving major crypto giants that followed. After understanding the wallets that conducted large-scale transactions of stETH, it delves into various entities and analyzes their trading behaviors. Conclusions include:

• stETH is a derivative of ETH and does not strictly need to be traded on a 1:1 basis with ETH;

• The price of stETH is still fluctuating, creating opportunities for others to purchase stETH at prices lower than ETH;

• For most of the time, stETH has been trading with ETH (1:1) until the depeg of UST/LUNA changed that; after the depeg of UST, the stETH/ETH exchange rate in the Curve pool dropped to 0.94.

stETH Depeg Devastates Curve TVL

Before the depeg of UST, the price of stETH was relatively equal to ETH. After the collapse of UST, the stETH/ETH exchange rate began to fall below 1:1, and the gap continued to widen.

From June 1 to June 7, the ETH/stETH ratio in the Curve pool remained relatively stable at 0.45, while the price of stETH was at 0.98 ETH. Signs of a decreasing stETH/ETH exchange rate began to appear on June 7, at which point the ETH balance decreased and the stETH balance increased.

From June 9 to June 10, both ETH and stETH balances decreased by over 100,000, as stETH continued to trade at a 0.97 discount. Given the unstable macro environment, this led users to reduce position risk by removing liquidity and/or selling stETH for ETH. The loss of liquidity and additional selling pressure further stressed stETH, causing the exchange rate to drop to a low of 0.94 on June 11.

Although the stETH exchange rate slightly recovered to 0.96 on June 12, confidence among holders remained low due to continued outflows from the Curve pool. Curve's TVL lost nearly $1 billion in just two weeks.

Large Redemptions Precede Drop by 4 Days

To understand what caused the price of stETH to decline relative to ETH, we studied wallets that conducted large stETH transfers in June. Although the first price drop occurred on June 7, significant redemptions began on June 3.

The chart below shows the largest stETH transactions from June 1 to June 12. Based on this data, we analyzed the top transactions of various entities, mainly occurring between June 3 and June 11.

The table below shows the top 11 wallets that conducted large stETH transfers from June 3 to June 11, arranged chronologically:

What is Crypto Asset Management Platform Amber Group Doing?

On June 10 at 8:37 (all times in UTC), Amber Group (0x12b5c9191e186658841f24319433c47278f68e075) withdrew all liquidity from the stETH-ETH Curve pool, totaling 83,380.47 stETH and 26,733.52 ETH. At that time, the price of stETH was 0.96 ETH. Given that the ETH/stETH ratio in the Curve pool was 28%, Amber Group likely wanted to "retain" liquidity before more ETH was drained.

From June 10 at 4:05 to June 11 at 7:27, Amber Group sent a total of 77,941 stETH to FTX deposit addresses through six separate transactions. Considering the liquidity of the stETH/USD market on FTX was very thin, Amber was unlikely to sell their stETH on the open market. At that time, there were very few orders, and selling just $16,000 would cause a 2% price drop, while the market value of their stETH position was approximately $125 million. Amber Group may have reached an OTC deal with FTX, or they were simply trying to mask their stETH position through a CEX like FTX.

Crypto Lending Platform Celsius

The wallets to be analyzed below include:

From June 8 to June 9, Celsius withdrew a total of 50,000 stETH from Aave through multiple transactions from Wallet A. The funds were sent to Wallet A's close trading partner—Wallet B—then through Wallet C, ultimately deposited into FTX, which may signal OTC trading.

During the same period, Wallet D sent additional funds to Wallet A in the form of WBTC, USDT, USDC, and DAI. These funds were either used to increase collateral or repay debts to Aave and Compound.

Given the market volatility and the need to meet customer redemption demands, Celsius may face liquidity issues. With the depletion of the stETH-ETH Curve pool and liquidity running dry, Celsius would not have enough liquidity to exit its stETH position. Within 6-12 months post-Ethereum merge, stETH cannot be redeemed for ETH, and the only intermediaries for trading ETH are secondary markets. With 409,000 stETH deposited in Aave and only 127,000 ETH remaining in Compound, Celsius cannot "unload" on-chain stETH without incurring slippage losses. Furthermore, compared to the Curve pool, the liquidity and trading volume on CEX are negligible, making it impossible to sell through CEX.

Additionally, from June 8 to June 12, Celsius borrowed USDC and USDT from Compound and Aave using Wallet A, sending the funds to Wallet E, possibly to meet redemptions. A total of $59.5 million in USDC and $2 million in USDT were borrowed on-chain. Wallet A also withdrew 112,500 ETH and sent it to Wallet E. To maintain a healthy loan-to-value ratio, they continuously sent funds from Wallet D to Wallet A to repay loans and replenish collateral.

From June 10 to June 12: After Celsius halted withdrawals, Wallet B sent a total of 108,900 ETH to Wallet F, which subsequently sent the same amount to 0xfdc8eb4815e58152c956c367323b5e08d29f0438 (FTX deposit address), which was then transferred to 0xc098b2a3aa256d2140208c3de6543aaef5cd3a94 (FTX address).

These funds from Wallet B came from several wallets—52,800 ETH from Wallet A, 42,000 ETH from Wallet F, 13,600 ETH from Wallet D, 1,400 ETH from 0x07ce9e0375497c81c603c63f37ffbc03860c23f9, and 1,000 ETH from 0xe081abb7d9e327e89a13e65b3e2b6fcaf2eceb97.

On June 13 between 1-2 AM, Wallet B also sent a total of 9,000 WBTC to 0x76a05277b81b9ca6c06c9ab4136116fc53e9c9e1 (FTX deposit address). These funds all originated from Wallet A.

As of June 22, Wallet A remained the top lender/borrower of ETH (including wETH and stETH) and wBTC on Aave and Compound, with a total collateral value of nearly $1 billion. Currently, as long as their collateral prices do not suddenly drop by 37%, their health ratio remains relatively strong. On Aave, the health ratio is 1.88 (meaning the price would need to drop by 47% to be liquidated). The price-to-earnings ratio on Compound is 1.58 (meaning the price would need to drop by 37% to be liquidated).

Whale Wallets

In addition to the entities mentioned above, we also looked at whale wallets that had large stETH transactions between June 1 and June 15, narrowing it down to seven key wallets.

1. Wallet Address: xd275e5cb559d6dc236a5f8002a5f0b4c8e610701 (DEX Trading Whale)

On June 3 at 15:18, this wallet withdrew all liquidity from the stETH-ETH Curve pool, totaling 47,353 stETH and 3,991 ETH. At that time, the ratio was 0.978 stETH/ETH. Within 20 minutes, the wallet deposited all the funds into Aave to replenish collateral. From June 10 at 13:40 to June 13 at 15:54, the wallet conducted multiple trades of ETH and stETH, netting 3,421 stETH, which were ultimately all deposited into its Aave loan position. There seems to be no malicious behavior here; the wallet simply withdrew its liquidity from Curve and deposited it into Aave as collateral, likely to prevent liquidation during market volatility.

2. Wallet Address: 0xca2c8b7664fa4169bd85da72a968dab9b78f5882 (Token Whale), 0x7ccd3befb83154b99c02f4dd5aec5dd76f1ee0b2 (ETH Whale)

Between 9-10 PM on June 6, the two wallets withdrew all liquidity from the stETH-ETH Curve pool: 54,076 stETH/23,515 ETH and 54,103 stETH/23,489 ETH. Both wallets still hold all their stETH, and when removing liquidity from Curve, the stETH/ETH ratio was 0.978. Both wallets likely wanted to avoid insufficient liquidity in the pool and decided to proactively clear liquidity.

3. Wallet Address: 0x1b2382E16268c26F5dfC814a84ae156671362B5C, 0x2E85891e813b9Bd72db0b9065414B9888D1FDFDD

From June 8 at 4:57 to 6:32, the two wallets received 22,855 stETH and 19,998 stETH from FTX exchange wallets. At 7:45 AM on June 8, 0x1b swapped all 22,855 stETH for 22,323 ETH via Cowswap, while 0x2E swapped 19,998 stETH for 19,481 wETH via CoW Protocol. In the following two days, the exchanged ETH was sent to their FTX deposit addresses, clearing out the wallets. Note that both wallets added ETH from FTX and are brand new wallets.

4. Wallet Address: 0xcde35b62c27d70b279cf7d0aa1212ffa9e938cef

This wallet withdrew all liquidity of 38,420 stETH and 2,706 WETH from the stETH-ETH pool on June 10 at 2:42. Subsequently, all stETH funds were deposited into their Aave loan to replenish collateral. Between June 10 and June 12, they began further reducing risk by repaying Aave loans.

5. Wallet Address: 0x5f8f52ddc15990a45ba5aab85dfd9fdfae11b661

This wallet cleared all liquidity of 24,607 stETH and 6,689 ETH from the stETH-ETH pool on June 10 at 17:23. The wallet still retains all its stETH. Similarly, the wallet's behavior does not indicate any suspicious signs; it may be unwilling to provide liquidity, knowing that the pool may run out of ETH.

Crypto Hedge Fund - Three Arrows Capital

From June 1 to June 11, we observed a total of 18,050 ETH transferred from 3AC to Deribit, most of which was delivered after June 7. These ETH deposits into derivatives may have been used as additional collateral to protect 3AC's current positions or to take new positions, thereby hedging 3AC's current portfolio.

On June 7 at 1:41, Wallet A withdrew a large amount of 29,054 stETH from BlockFi and sent it directly to Wallet B. Shortly after, the received 9,710 stETH was deposited as collateral in Aave.

On the same day at 2:20, 3AC became more cautious as Wallet B used the previously deposited 9,709 stETH as collateral to borrow 7,000 ETH from Aave. Within five minutes, this 7,000 ETH was rapidly sent to 3AC's FTX deposit address, possibly for sale. This transaction may have been used to hedge against downward pressure on ETH prices.

On June 8, perhaps 3AC was still quite satisfied with their positions. Wallet B was observed withdrawing 1,785 stETH collateral from Aave, while Wallet E exchanged 9,400 wETH for 9,652 stETH on the 0x Protocol.

Shortly after the transaction, Wallet E then deposited 700.48 wETH and 9,652.89 stETH into the Curve stETH concentrated pool.

Interestingly, between June 8 and 9, we saw Wallet D receive 2,500 ETH from a wallet marked as highly active by Nansen (0x962fe6f349c320417e1992443c0852b1d95060f2) and 1,700 ETH from Deribit; of which 4,000 were sent back to FTX.

On June 11, Wallet E withdrew liquidity from the previously added Curve stETH concentrated pool on June 8 and sent 10,387.66 stETH to Wallet F, which subsequently deposited the received 7,282.4 stETH into Aave as collateral and borrowed 4,790 ETH, sending it directly to Deribit.

On June 13, we began to see signs of panic. Wallet G started unwrapping its wstETH and selling it through Cow Protocol for wETH. In just that day, Wallet G conducted five transactions on Cow Protocol, exchanging approximately 46,100 wETH for 49,022 stETH.

A large portion of these wstETH was confirmed to come from Wallet I, which transferred a total of 34,600 wstETH to Wallet G between June 13 and 14.

Wallet G also withdrew 675.1 steCRV liquidity from the Curve stETH pool and exchanged it for 679.9 ETH. Interestingly, Wallet G also sent two large transactions to Wallet H, which is marked as a "whale" by Nansen. The steCRV tokens represent shares in the Curve stETH-ETH pool.

The first of these transactions was a transfer of 12,967 ETH to Wallet H at 4:11 on June 13. Around 17:35, another transaction of 33,856 ETH was subsequently transferred to the same Wallet H.

On June 14, 3AC actively repaid debts to Aave.

Starting at 8:08, Wallet D received 14,950 ETH from FTX in nine transactions. Among them, 4,790 ETH was transferred to Wallet F at 8:17, and then at 8:19, they were transferred to Aave to repay loans.

On that day, Wallet B and Wallet F also prohibited stETH as collateral on Aave, marking the end of their Aave positions. At 9:10, at least 88,626 stETH was withdrawn from Aave.

Throughout the morning, we observed Wallets B/C/F withdrawing stETH collateral from Aave and clearing their stETH positions by exchanging their stETH (including those previously withdrawn from Aave) for ETH on the 0x Protocol and CoW Protocol. A large portion of these ETH was simultaneously used to repay 3AC's loans on Aave. Subsequently, Wallet C sold the previously received ETH for DAI.

• Wallet B traded a total of 38,900 stETH for 36,718 ETH in two transactions;

• Wallet C traded a total of 17,780 stETH for 16,625 ETH, used to trade for 20 million DAI;

• Wallet F traded 7,284 stETH for 6,981 ETH.

Starting from June 15, we observed that 3AC began to close its ETH/stETH positions by converting tokens into stablecoins. For example, as of June 16, Wallet B continued to sell the remaining stETH held in the wallet, totaling approximately $19.8 million in USDT on the 0x Protocol.

Summary

Recent discussions about the stETH "depeg" are hot topics, but the fundamentals of the current situation were established during the collapse of UST a month ago.

Observing the main liquidity pool of stETH on Curve, it is evident that there was an initial significant drop in liquidity during this period, with severe imbalances in the reserves of stETH and ETH in the pool. Terra's largest protocol, Anchor, was a gathering place for a large amount of stETH, and as Terra ultimately collapsed, the vast majority returned to the mainnet between May 7 and 16. On May 8, a single entity transferred 74,700 stETH from Terra back to the mainnet via a cross-chain bridge and sold most of it for UST, possibly to resist the depeg of UST. Subsequent cross-chain activities were likely due to concerns about the collapse of Terra and stETH being stuck, or fears of being drained due to weakened chain security.

This increased the selling pressure on stETH, which in turn may have prompted many LPs in the stETH/ETH Curve pool to withdraw their liquidity, with the largest being 3AC and Celsius, which collectively withdrew $780 million in liquidity on May 12 (notably, although a large amount of liquidity was withdrawn from the pool primarily in stETH, neither 3AC nor Celsius were major sellers of stETH or retained a large portion of stETH during this period). Therefore, other large participants with (over)leveraged stETH/ETH positions on Aave attempted to close their positions, which relied on a stETH:ETH price ratio close to 1, leading to greater selling pressure on stETH. Currently, the main stETH Curve pool has not recovered, still maintaining significantly lower liquidity and severe ETH/stETH imbalance.

In recent events, the withdrawal of funds from the Curve pool indicates that many are looking to reduce investment risks. Large players like Celsius and 3AC are affected by the market downturn, further exacerbating the price deviation of stETH/ETH. In the case of Celsius, maintaining liquidity to meet customer redemptions may be its top priority. Therefore, they must eliminate reliance on other liquid assets while protecting leveraged assets by repaying debts. Halting withdrawals likely helps prevent a bank run while giving Celsius time to readjust and manage risks in its investments.

From on-chain data, we observe that 3AC is unlikely to have caused the significant price deviation of stETH from ETH during June 9 to 11, and seems to be a victim of this "contagion." The lack of sound risk management and excessive leverage can be said to be a bomb that detonated the stETH "depeg." As previously mentioned, it was not until June 13 and 14 that 3AC began to close its stETH positions for ETH and stablecoins, most likely to reduce its risk and minimize losses.